IJ57596: KERBEROS THROWS NULLPOINTEREXCEPTION

APAR status

• Closed as program error.

Error description

• Error Message: N/A
  .
  Stack Trace: Caused by: java.lang.NullPointerException at
                  java.lang.StringBuffer.(StringBuffer.java:148)
  at
  
  com.ibm.security.krb5.KrbTgsRep.(KrbTgsRep.java:66) at
  
  com.ibm.security.krb5.KrbTgsReq.getReply(KrbTgsReq.java:247) at
  
  com.ibm.security.krb5.KrbTgsReq.sendAndGetCreds(KrbTgsReq.java:2
  54)
                  at
  
  com.ibm.security.krb5.internal.CredentialsUtil.serviceCreds(Cred
  entialsUtil.java:319)
                  at
  
  com.ibm.security.krb5.internal.CredentialsUtil.serviceCredsRefer
  rals(CredentialsUtil.java:376)
                  at
  
  com.ibm.security.krb5.internal.CredentialsUtil.serviceCreds(Cred
  entialsUtil.java:340)
                  at
  
  com.ibm.security.krb5.internal.CredentialsUtil.getTGTforRealm(Cr
  edentialsUtil.java:212)
                  at
  
  com.ibm.security.krb5.internal.CredentialsUtil.acquireServiceCre
  ds(CredentialsUtil.java:163)
                  at
  
  com.ibm.security.krb5.Credentials.acquireServiceCreds(Credential
  s.java:279)
                  at
  
  com.ibm.security.jgss.mech.krb5.Krb5Context.initSecContext(Krb5C
  ontext.java:324)
                  at
  
  com.ibm.security.jgss.GSSContextImpl.initSecContext(GSSContextIm
  pl.java:308)
                  at
  
  com.ibm.security.jgss.GSSContextImpl.initSecContext(GSSContextIm
  pl.java:272)
                  at
  
  com.ibm.security.sasl.gsskerb.GssKrb5Client.evaluateChallenge(Un
  known
                  Source)
  .
  

Local fix

• The NullPointerException is not the root cause of the problem.
  The
              root cause is that the Ticket Granting Service reply
  from the Key
              Distribution Center cannot be parsed.
  

Problem summary

• Kerberos throws a NullPointerException when a Ticket Granting
              Service Reply from KDC (KrbTgsRep) cannot be parsed
  and the
              associated KRBError has null for message text.
  

Problem conclusion

• The Kerberos code was modified to check for null message text.
              The associated Hursley RTC Problem Report is 153905
  The associated
              Austin GIT defect in IBMJGSS#154 The associated
  Austin APAR is N/A
              JVMs affected: Java 8.0 The fix was delivered for:
  Java 8 sr8 fp65
              (20250627-465)
  
              The affected jar is ibmjgssprovider.jar
  
  .
  This APAR will be fixed in the following Releases:
  .
  IBM Semeru Runtimes
  IBM SDK, Java Technology Edition
     8    SR8 FP65  (8.0.8.65)
  .
  Downloads and supplementary documentation can be found at the
  following locations:
  - For non z/OS operating systems:
    - IBM Semeru Runtimes, Version 11 and later
      https://www.ibm.com/semeru-runtimes/downloads/
    - IBM SDK, Java Technology Edition, Version 8
      https://www.ibm.com/support/pages/java-sdk-downloads/
  - For the z/OS operating system:
    - Java SDK Products on z/OS
      https://www.ibm.com/support/pages/java-sdk-products-zos
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  SECURITY

• Fixed component ID

  620700125

Applicable component levels